<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">I am trying to setup a vpn tunnel from an embedded linux system (Linux system-0004338 2.6.37 #7 Mon Jun 22 14:45:53 PDT 2015 armv7l GNU/Linux) to a cisco asa. I have a working solution but not the preferred one. <div class="">One of my first problems was when I let strong swan add the routes it didn’t over write the default route so no traffic would go through. I was able to solve this by using the an up/down script. But I would prefer that strong swan added/removed the routes. </div><div class="">The routes it added looked like this</div><div class=""><div class=""> ip route</div><div class="">10.255.254.180/30 dev usb1 src 10.255.254.180 </div><div class="">0.0.0.0/1 via 10.255.254.181 dev usb1 src 10.3.10.18 </div><div class="">128.0.0.0/1 via 10.255.254.181 dev usb1 src 10.3.10.18 </div><div class="">default via 10.255.254.181 dev usb1 </div></div><div class=""><br class=""></div><div class="">where the default route at the bottom was there already.</div><div class="">The route table before was</div><div class=""><div class=""> ip route</div><div class="">10.255.254.180/30 dev usb1 src 10.255.254.180 </div><div class="">default via 10.255.254.181 dev usb1 </div></div><div class=""><br class=""></div><div class="">The second issue is with the system time fix plugin. After the device gets a valid time from ntp over the tunnel it invalidates the client sa. </div><div class="">time fix config </div><div class=""><a href="http://pastebin.com/B5WHHbLE" class="">system time fix</a></div><div class=""><a href="http://pastebin.com/0yu1YFKm" class="">LOGFILE</a> showing the sa being invalidated</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">The configuration I would like is where if usb1 goes up (after having been up before) strong swan reconnects the tunnel. Currently if usb1 goes down (for longer than dpd) and then comes up again and the dhcp client gets/assigns an address to usb1 strong swan does not reconnect the tunnel. If I use ipsec up home it comes back up.</div><div class="">My current working <a href="http://pastebin.com/B7vPqqDd" class="">ipsec.conf</a></div><div class=""><a href="http://pastebin.com/zY6ZzZgC" class="">charon.conf</a></div><div class=""><a href="http://pastebin.com/JGksUE8p" class="">updown script</a></div><div class=""><br class=""></div></body></html>